rewards-quickswap[.]com

PhishDestroy identifies the domain rewards-quickswap.com as a recently activated crypto drainer impersonating the legitimate QuickSwap DEX. This domain leverages a typosquatted naming convention to deceive users into connecting crypto wallets under the false pretense of a rewards program. The threat actor appears to be distributing a drainer kit designed to siphon digital assets upon wallet connection, a growing trend in DeFi-related phishing campaigns. Initial behavioral analysis suggests the site mimics QuickSwap’s UI flow to lower user suspicion and facilitate unauthorized token transfers.

Technical indicators associated with this domain are as follows: registered on April 06, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED; resolving to IP 104.21.51.244; secured with a Let’s Encrypt SSL certificate; and currently showing 0 detections out of 95 on VirusTotal. The domain remains unblocked in Google Safe Browsing (GSB) and has not yet been flagged by major threat intelligence feeds, indicating a window of active exposure. These attributes, combined with the recent domain creation, point to an emerging and potentially escalating threat with limited current detection coverage.

As of this report, the domain is active and under investigation by PhishDestroy with a status of under_investigation and a provisional risk level of under_investigation. Response actions include ongoing behavioral analysis, sandbox detonation of payloads, and coordination with hosting providers and registrars for takedown. However, the risk remains active due to the lack of broad detection and the domain’s fresh infrastructure. Users are strongly advised to verify any QuickSwap-related link using PhishDestroy’s real-time lookup tool before interacting with wallet connection prompts or reward offers.